Introduction To Information Security

Page 1

What is Information Security?

Protection of information resources

Necessary for responsible individual or organization to secure confidential information

Minimize business risk and consequences of losing crucial data

Task of securing information in digital format

Impact of security

Increasing security decreases convienience

Page 2

CIA Triad

Confidentiality

The assurance that the information is only available to those who only have access

Integrity

The trustworthiness of data or resources ensuring that the data is correct and unaltered

Availablity

The assurance that the systems responsible for delivery, storing and processing of information are available when required by authorized users

Page 3

Information System Terminology

Asset

Item that has value

Threat

Type of action that has the potential to cause harm

Threat Actor

Person or element with power to carry out threat

Vulernability

Flaw or weakness that allows threat agent to bypass security

E.g. improper input handling

Threat Actor

Means of which an attack can occur

Threat

The potential of a threat actor to exploit a vulnerability

Risk

Likelihood and impact of a threat actor exercising a vulnerability

Page 4

Risk Response Techniques

Accept

Risk is acknowledged but no steps are taken to address it

Transfer

Transfer risk to a third party

Avoid

Identifying risk but making the decision to not engage in the activity

Mitigate

Attempt to address risk by making the risk less serious

Page 5

Type of Assets

Tangible assets

Physical items

Intangible assets

Information resources

Human Capital

Organisation's staff

Value

Most assets have a specific value associated with them

Assets must be valued according to the liabilities that the loss or damage of the asset would create

Page 6

Data In Different Business Functions

Product development, production, fulfilment, and maintenance

Customer contact information

Financial operations and controls (collection and payment of debts, payroll, tax, financial reporting

Legal obligations to maintain accurate records for a given period.

Contractual obligations to third parties (Service Level Agreements)

Page 7

Threat Actor

Threat actor

Individuals who launch attacks against other users and their computers

Most have a goal of financial gain

Recognized in distinct categories

Funding and resources

Internal or external to the enterprise or organisation

Intent and motivation

Page 8

Threat Actor Types

Script kiddies

Lack knowledge of attacking computers and network

Uses tools without understanding of how they work

Nation States

Use Cybersecurity expertise and use cyber weapons

Has military and commercial goals.

Advanced Persistent Threat

On-going ability of an adversary to compromise network security using variety of tools and technique.

Hackivists

Attack for ideological reasons that are generally not well defined

e.x. Breaking into a website and changing the contents on the site.

Malicious Insiders

Employees that attack with the intention to cause harm to the organisation they work for

e.x Disgruntled health care worker may publicize celebrities’ health records

Competitors

Launch attack against an opponent’s system to steal classified information

May steal new product research or list of current customers to gain a competitive advantage

Organized Crime

Moving from traditional criminal activities to more rewarding and less risky online attacks

Usually run by a small number of experienced online criminal networks who act as entrepreneurs

Brokers

Sell their knowledge of a vulnerability to other attackers or governments

Uncover vulnerabilities to sell them to the highest bidder

Cyberterrorist

Attack a nation’s network and computer infrastructure to cause disruption and panic among citizens

Goals include a small group of computers or networks that can affect the largest number of users

Page 9

Social Engineering Attacks

Definition

A means of gathering information for an attack by targeting on weaknesses of individuals

Types of social engineering attacks

Impersonation, spoofing

a spoofing attack is a situation in which a person or program successfully masquerades as another by falsifying data, to gain an illegitimate advantage

e.x. forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source

Familiarity/Liking

familiarize him/herself with the users of the target system to gain information to carry out the attack

e.x. user works in a building that requires an access code or card to gain access; the attacker may follow the users as they enter such places.

Consensus/Social Proof

Take advantage of fake testimonials to gain trust of users

e.x. set up some web sites with dozens of testimonials listing all the benefits of their fake antivirus software (rogueware)

Authority and intimidation

Take advantage of users by putting them in a difficult situation where they seek to avoid confrontation

e.x. pretend to have a heated argument on the phone or with an accomplice in the scheme. The attacker may then ask users for information which would be used to compromise the security of the users’ system

Scarcity and Urgency

Takes advantage of limited access or less available opportunities to push users to reveal information

e.x. direct people to a fraudulent website under the guise that Facebook will be disabling unconfirmed accounts today

Shoulder surfing

obtain information such by looking over the victim's shoulder.

e.x. looking at what users are typing on the ATM

Tailgating

involve someone who lacks the proper authentication following a user into a restricted area

e.x. using an employee owned computer to access the organisation network

Page 10

Corporate Security Policy

aim to obtain support for security awareness in the organization and outline in general terms risks, guidelines, and responsibilities.

Employees must understand how to use ICT securely and safely

Be aware of their responsibilities.

Removes any uncertainty that employees may have about what to do in a given situation

Page 11

Standards and Best Practice

Standard

a measure by which to evaluate compliance with the policy.

Procedure

step-by-step listing of the actions that must be completed for any given task.

Guidance/Guidelines

exist for areas of policy where there are no procedures,

Page 12

Personnel Management Policies

Human Resources

tasked with recruiting and managing the organization's most valuable and critical resource: people

Three Phrases of Applying

Recruitment (hiring)

Operation

Termination or separation

Page 13

Data Roles

Data Owner

a senior (executive) role with ultimate responsibility for maintaining the CIA of the data asset

Data Steward

primarily responsible for data quality

Data Custodian

responsible for managing the system on which the data assets are stored.

Privacy Officer

responsible for oversight of any PII assets managed by the company.

Page 14

Data Sensitivity Labeling & Handling

Unclassified/Public

no restrictions on viewing the document

Classified/Private /Restricted /Internal use only / Official use only) ​​​​​​

viewing is restricted to the owner organization or to third-parties under a Non-Disclosure Agreement

Secret/Medium

too valuable to permit any risk of its capture

viewing is restricted

Top Secret/High

highest level of classification

Page 15

Privacy & Employee Conduct Policies

Acceptable Use Policy/ Fair Use Policy

sets out what someone is allowed to use a particular service or resource

eg how employees use equipment and services (such as telephone or Internet access) provided to them at work

Rules of Behavior

employees' use of the social networking and file sharing poses substantial risks to the organization.

Use of Personally Owned Devices

e.g smartphones, USB sticks, media players in the Workplace.